CVE-2026-49093: Elastic Kibana

High severity, CVSS 7.7. EPSS: 0.3% chance of exploitation in the next 30 days.

Server-Side Request Forgery (CWE-918) in Kibana can allow an authenticated user with connector management privileges to bypass the operator-configured connector allowlist, causing the Kibana server to issue outbound requests to destinations the egress controls were intended to block.

Affected products

• Elastic Kibana: from 9.3.0, before 9.3.3 (fixed in 9.3.3)

Published 2026-05-28. Last modified 2026-07-21.